ChestnutCMS version 1.5.10 contains a critical SQL injection vulnerability. The flaw exists in the admin backend where the content parameter of the cms_content tag can be manipulated and injected into a SQL query during template rendering. This vulnerability allows an unauthenticated attacker to execute arbitrary SQL commands, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.